5380 Security log · Credential Manager medium severity low volume

Windows Event ID 5380 — Vault credentials were found

Credentials were found in the Windows Vault.

Why event 5380 matters

Windows Vault stores RDP credentials and internet passwords. Access to vault credentials by unexpected processes indicates credential harvesting.

How to detect it

Alert: vault credential access by non-expected processes (PowerShell, cmd, unknown tools).

Log source
Security
Advanced Audit Policy — enable the 'Credential Manager' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic Technique
Credential Access Windows Credential Manager (T1555.004)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 5380   // Vault credentials were found
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=5380
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Vault credentials were found — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 5380 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Credential Manager events

5376 Credential Manager credentials were backed up 5377 Credential Manager credentials were restored from a backup 5378 The requested credentials delegation was disallowed by policy 5379 Credential Manager credentials were read 5381 Vault credentials were listed 5382 Vault credentials were read

Frequently asked questions

What is Windows Event ID 5380?

Vault credentials were found. Credentials were found in the Windows Vault.

Which log records event 5380?

Event 5380 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Credential Manager' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 5380?

Event 5380 is associated with: Windows Credential Manager (T1555.004).

How do you detect activity around event 5380?

Alert: vault credential access by non-expected processes (PowerShell, cmd, unknown tools).